High
CVE-2026-8197
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Critical
CVE-2026-8134
Concrete CMS Vulnerable to Relative Path Traversal
Medium
CVE-2026-46638
Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
Low
CVE-2026-46637
Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`
Low
CVE-2026-46635
Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)
Medium
CVE-2026-46634
Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
Critical
CVE-2026-46633
Twig: PHP code injection via `{% use %}` template name
Low
CVE-2026-46629
twig/intl-extra: Unbounded formatter memoisation in keyed on template-controlled arguments
Low
CVE-2026-46628
Twig: The `spaceless` filter implicitly marks its output as safe
High
CVE-2026-46625
JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection
High
CVE-2026-82855
@hulumi/policies: Stack-wide evidence bypassed Cloudflare and deployment-governance guardrails
Critical
CVE-2026-82856
@hulumi/policies: GitHub OIDC trust policy bypass via AWS set-qualified condition operators
High
CVE-2026-82860
@hulumi/policies: CIS 1.16 admin policy bypass for inline and attached IAM policies
High
CVE-2026-82861
@hulumi/policies: HULUMI-H1 SecureBucket parent spoof bypass
High
CVE-2026-82858
@hulumi/drift: Orphan reconciler accepted externally supplied execute plans
Medium
CVE-2026-82863
@hulumi/baseline: CloudTrail selector tampering events were not fully detected
Medium
CVE-2026-46609
Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog
Low
CVE-2026-46554
NocoDB: Stale Auth Cache After API Token Deletion
Low
CVE-2026-46553
NocoDB: Attachment Size Limit Bypass via Upload-by-URL
Medium
CVE-2026-46552
NocoDB: Shared-base link access can invite arbitrary users as persistent base members
Medium
CVE-2026-46551
NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion
Medium
CVE-2026-46550
NocoDB: Refresh Token Cookie Set Without `secure` and `sameSite` Flags
Low
CVE-2026-46549
NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation
Medium
CVE-2026-46548
NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.